Step 1 — Create the Windows Server VM in Azure

In this step, you will create a low-cost in . Most settings can be left at their defaults — only the critical ones are called out explicitly.

What this may cost

Rough estimate: $2-$8 if you complete the lab quickly; roughly $25-$40/month per B2s Windows Server VM if left running. Actual Azure pricing varies by region, VM size, subscription, credits, and how long you leave the lab running.

A Windows Server domain controller VM in this step
A second Windows Server client VM later in the lab
Managed disks, public IPs, network interfaces, and a virtual network

Stop/deallocate lab VMs whenever you pause. Delete the resource group when you are done.

How to stop billing

In the Azure Portal, stop each VM and confirm the status is Stopped (deallocated).
When you are finished with the lab, delete the entire ad-lab-rg resource group.
Verify the resource group, VMs, disks, public IPs, and network interfaces are gone.

Deallocating stops VM compute charges. Deleting the resource group is the cleanest way to remove disks, public IPs, and other billable resources.

1. Create the Virtual Machine

Log into the Azure Portal
Navigate to Virtual Machines
Select Create → Azure virtual machine

2. Basics Tab (Important)

Subscription: Leave default
Resource Group: Create a new one (e.g. ad-lab-rg)
Virtual Machine Name: DC01
Region: Closest region to you
Availability Options: Leave default
Image: Windows Server 2022 Datacenter
Size: B2s or similar

3. Administrator Account

Username: Any name
Password: Strong password — save this

This local administrator account will later become your first domain administrator.

4. Inbound Port Rules

Public inbound ports: None

Why not open RDP here

This tab has no source control, so allowing (3389) here opens it to the whole internet, where exposed servers are scanned and attacked within minutes. Leave the ports closed now. Step 10 below adds a rule that allows only your own address.

5. Disks Tab

OS disk type: Standard SSD
Leave all other settings at their defaults

6. Networking Tab (Do Not Skip)

Virtual network: Create new
Subnet: Default
Public IP: Create new
NIC network security group: Basic
Public inbound ports: None

Why this matters

Your and future client VM must be on the same . Fixing this later causes and authentication issues.

7. Management, Monitoring, Advanced, Tags

Leave all settings at their defaults

8. Review + Create

Review your settings
Select Create
Wait for deployment to complete

9. Set a Static Private IP (Recommended)

Open the VM → Networking
Select the Network Interface (NIC)
Go to IP configurations
Change Private IP assignment from Dynamic to Static
Save your changes

This prevents IP changes that can break DNS and Active Directory later.

10. Allow Remote Desktop From Your Address Only

Open the VM → Networking
Select → Add inbound port rule
Set Source to My IP address
Set Protocol to TCP and Destination port ranges to 3389
Set Action to Allow, name the rule allow-rdp-myip, then save

Never set the source to Any or Internet. Remote Desktop is the only port you open; never publish DNS, LDAP, Kerberos, or SMB. Home connections change address periodically, so edit this rule rather than widening it.

Checkpoint

0 of 5 verified

Check each item after verifying it in your environment.

VM deployed successfullyYou can RDP into DC01The inbound RDP rule lists your own address as the source, not AnyWindows Server desktop loadsPrivate IP is set to Static

Saved on this device. Self-checks do not award XP or replace the quiz.

If any of these fail, stop and fix the issue before moving on.